Static task
static1
Behavioral task
behavioral1
Sample
fe3f5e184db2a6f78a120ec11872ecbb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe3f5e184db2a6f78a120ec11872ecbb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fe3f5e184db2a6f78a120ec11872ecbb_JaffaCakes118
-
Size
324KB
-
MD5
fe3f5e184db2a6f78a120ec11872ecbb
-
SHA1
a25ac9affdefb3faf809218f9e925a577d219b4e
-
SHA256
412474206a1d6ab36a6664838e89b75d34bd69c2d540692d7062b5e45e18f427
-
SHA512
f9bf00ecd7de343cbe4cf6acc23c5f47a33deebf18c738ffc44999c596c74b5e9f5598376350369462cc16b4a50a770a743041114001e4e9971aa48dc81d53c6
-
SSDEEP
6144:IJjXdoirAw5bNX7olnuUxjyidjPavMkjRgfWq/T89yqmEm:cjX2iccN6VyiVaxiFhF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe3f5e184db2a6f78a120ec11872ecbb_JaffaCakes118
Files
-
fe3f5e184db2a6f78a120ec11872ecbb_JaffaCakes118.exe windows:5 windows x86 arch:x86
8baf80103f3dbf1110ed71546ab331d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyW
GetStartupInfoA
FindResourceW
DeleteCriticalSection
lstrlenW
DisableThreadLibraryCalls
lstrcmpiW
LoadResource
EnterCriticalSection
lstrcatW
InitializeCriticalSection
lstrcpynW
GetLastError
HeapDestroy
MultiByteToWideChar
InterlockedDecrement
lstrlenA
FreeLibrary
SizeofResource
GetModuleFileNameW
InterlockedIncrement
LeaveCriticalSection
rpcrt4
RpcStringFreeW
ntdll
NtAllocateVirtualMemory
RtlAdjustPrivilege
RtlAddAccessAllowedAce
msvcrt
wcscpy
__CxxFrameHandler
realloc
_adjust_fdiv
_purecall
free
wcslen
wcsncat
_initterm
_except_handler3
wcsncpy
malloc
advapi32
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ole32
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VariantClear
user32
CharNextW
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE